Archipelago » qemu

@itemize @minus

Full system emulation. In this mode, QEMU emulates a full system

(usually a PC), including a processor and various peripherals. It can

be used to launch an different Operating System without rebooting the

PC or to debug system code.

User mode emulation (Linux host only). In this mode, QEMU can launch

Linux processes compiled for one CPU on another CPU. It can be used to

launch the Wine Windows API emulator (@url{http://www.winehq.org}) or

QEMU generic features:

@item User space only or full system emulation.

@item Precise exceptions support.

in other projects (look at @file{qemu/tests/qruncom.c} to have an

example of user mode @code{libqemu} usage).

@end itemize

QEMU user mode emulation features:

@item Generic Linux system call converter, including most ioctls.

@item clone() emulation using native CPU clone() to use Linux scheduler for threads.

@end itemize

QEMU full system emulation features:

@item QEMU can either use a full software MMU for maximum portability or use the host system call mmap() to simulate the target MMU.

@end itemize

QEMU x86 target features:

LDT/GDT and IDT are emulated. VM86 mode is also supported to run DOSEMU.

@item Support of host page sizes bigger than 4KB in user mode emulation.

@item QEMU can emulate itself on x86.

It can be used to test other x86 virtual CPUs.

@end itemize

Current QEMU limitations:

@item No SSE/MMX support (yet).

@item IPC syscalls are missing.

memory access (yet). Hopefully, very few OSes seem to rely on that for

normal use.

10 byte @code{long double}s of x86 for floating point emulation to get

maximum performances.

@itemize

FPU and MMU.

@item Can run most PowerPC Linux binaries.

Current QEMU limitations:

@item IPC syscalls are missing.

instructions to build a function (see @file{op.h:dyngen_code()}).

In essence, the process is similar to [1], but more work is done at

A key idea to get optimal performances is that constant parameters can

be passed to the simple operations. For that purpose, dummy ELF

Correct translated code invalidation is done efficiently by maintaining

a linked list of every translated block contained in a given page. Other

Although the overhead of doing @code{mprotect()} calls is important,

most MSDOS programs can be emulated at reasonnable speed with QEMU and

@section Exception support

longjmp() is used when an exception such as division by zero is

The host SIGSEGV and SIGBUS signal handlers are used to get invalid

memory accesses. The exact CPU state can be retrieved because all the

In order to avoid flushing the translated code each time the MMU

mappings change, QEMU uses a physically indexed translation cache. It

When MMU mappings change, only the chaining of the basic blocks is

reset (i.e. a basic block can no longer jump directly to another one).

@table @asis

@url{http://citeseer.nj.nec.com/piumarta98optimizing.html}, Optimizing

direct threaded code by selective inlining (1998) by Ian Piumarta, Fabio

Riccardi.

Willows Software.

@item [7]

The User-mode Linux Kernel.

@item [8]

The new Plex86 project.

@item [9]

The VMWare PC virtualizer.

@item [10]

The VirtualPC PC virtualizer.

@item [11]

The TwoOStwo PC virtualizer.

@end table